mediumMultiple ChoiceObjective-mapped

FC0-U71 Access control policy Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "effect": "Deny",
  "action": "s3:DeleteObject",
  "resource": "arn:aws:s3:::my-bucket/*",
  "condition": {
    "IpAddress": {
      "aws:SourceIp": "192.0.2.0/24"
    }
  }
}
```

An administrator reviews the following access control policy:

{
  "Rule": {
    "Effect": "Deny",
    "Action": "delete",
    "Resource": "file-server",
    "Condition": {
      "IpAddress": {
        "SourceIp": "192.0.2.0/24"
      }
    }
  }
}

What does it do?

⚠ Common exam trap

Watch out — candidates often confuse a Deny statement for a specific action with a blanket denial of all actions, or they misinterpret the IP condition as applying to all actions instead of only the listed action.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

It denies delete access to the file server for requests from the 192.0.2.0/24 IP range

The policy explicitly denies delete actions for requests originating from the 192.0.2.0/24 IP range. This is achieved by using a Deny effect in the access control rule's Condition block with the SourceIp condition key. The policy does not affect other actions or IP ranges, so only delete access is denied for that specific CIDR block.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
It denies delete access to the file server for requests from the 192.0.2.0/24 IP range
Why this is correct
The policy explicitly denies s3:DeleteObject for the specified IP range.
✗
It allows delete access to the file server for all IPs
Why it's wrong here
The effect is Deny, not Allow.
✗
It allows read access to the file server from the IP range
Why it's wrong here
The action is delete, not read.
✗
It denies all actions to the file server
Why it's wrong here
Only s3:DeleteObject is denied.

Visual reference

Go deeper

FC0-U71 Access control policy Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question